Vendor
Netty HttpContentDecompressor Brotli/Zstd/Snappy Decompression Bomb Vulnerability
3 rules 1 TTPNetty's HttpContentDecompressor and DelegatingDecompressorFrameListener are vulnerable to a decompression bomb denial-of-service attack because the maxAllocation parameter is not enforced when Content-Encoding is set to br (Brotli), zstd, or snappy, allowing attackers to bypass decompression limits and cause unbounded memory allocation.
Netty Lz4FrameDecoder Resource Exhaustion Vulnerability
2 rules 1 TTPNetty's Lz4FrameDecoder is vulnerable to resource exhaustion, where an attacker can cause excessive memory allocation by sending a small, crafted header, leading to a denial-of-service condition; this affects netty-codec-compression versions up to 4.2.12.Final and netty-codec versions up to 4.1.132.Final.
Netty DNS Codec Input Validation Bypass Vulnerability
2 rules 1 TTPNetty's DNS codec fails to enforce RFC 1035 domain name constraints, leading to potential DNS cache poisoning, denial-of-service, and domain validation bypass through null byte injection, overlength labels, silent truncation, and unbounded memory allocation.
Netty epoll Transport Denial of Service via RST on Half-Closed TCP Connection
2 rules 1 TTPNetty's epoll transport fails to properly close TCP connections that receive a RST after a half-close, leading to resource exhaustion and potential CPU busy-loops, impacting service availability.
Netty HttpClientCodec Response Desynchronization Vulnerability
2 rulesThe Netty HttpClientCodec is vulnerable to response desynchronization when configured with HTTP/1.1 pipelining, HEAD requests, and the server sends 1xx responses, leading to a response body from one request being parsed as another and potentially unsafe socket reuse.
Netty HTTP/3 QPACK Literal Unbounded Allocation Vulnerability
3 rules 1 TTPA vulnerability in Netty's HTTP/3 QPACK decoder allows an attacker to cause a denial of service by sending a crafted HTTP/3 header that triggers excessive memory allocation, leading to a server crash.